High integrity software is software that must be trusted to work dependably in some critical function, and whose failure to do so may have catastrophic results, such as serious injury, loss of life or property, business failure or breach of security. Some examples include software used in safety systems of nuclear power plants, medical devices, electronic banking, air traffic control, automated manufacturing, and military systems. The importance of high quality, low defect software is apparent in such critical situations. However, high integrity software is also important in more mundane business areas where defective software is often the norm.
Formal verification is the process of checking whether a design satisfies some requirements or properties. In order to formally verify a design, it must first be converted into a more condensed, verifiable format. The design is specified as a set of interacting systems, each having a finite number of configurations or states. States and transition between states constitute finite state machines (FSMs). The entire system is a FSM that can be obtained by composing the FSMs associated with each component. The first step in verification consists of obtaining a complete FSM description of the system. Given a present state (or current configuration), the next state (or successive configuration) of a FSM can be written as a function of its present state and inputs (transition function or transition relation). Formal verification attempts to execute every possible computational path with every possible state value to prove every possible state is consistent.
FIG. 1 is a flow diagram that illustrates a typical method for writing, compiling and executing a software program. At 100, a software program including multiple modules is written using a particular programming language. Each module includes one or more procedures. The programming language defines allowable procedure calling relationships. At 105, the software program is compiled. At 110, the software program is executed. During program execution, each procedure is potentially capable of calling any procedure in the program where allowed by the programming language. Thus, programs with a small number of procedures can potentially have a relatively large state space subject to program verification. This complicates proving program correctness. Moreover, the difficulty of proving program correctness typically increases during the software development cycle as the complexity of a program increases.
A virtual machine is an abstract computing machine generated by a software application or sequence of instructions that is executed by a processor. The term “architecture-neutral” refers to programs, such as those written in the Java™ programming language, which can be executed by a virtual machine on a variety of computer platforms having a variety of different computer architectures. Thus, for example, a virtual machine implemented on a Windows™-based personal computer system will execute an application using the same set of instructions as a virtual machine implemented on a UNIX™-based computer system. The result of the platform-independent coding of a virtual machine's sequence of instructions is a stream of one or more bytecodes, many of which are, for example, one-byte-long numerical codes.
The Java™ programming language is an object-oriented programming language. In an object-oriented system, a “class” describes a collection of data and methods that operate on that data. Taken together, the data and methods describe the state of and behavior of an object. Use of the Java™ programming language has found many applications including, for example, those associated with Web browsers. The Java™ programming language is described in detail in Gosling, et al., “The Java™ Language Specification”, August 1996, Addison-Wesley Longman, Inc. Programs written in the Java™ language execute on a virtual machine.
A Java™ virtual machine (JVM) executes virtual machine code written in the Java™ programming language and satisfies the Java™ Virtual Machine Specification (Lindholm, et al., “The Java™ Virtual Machine Specification”, April 1999, Addison-Wesley Longman, Inc., Second Edition). A Java™ virtual machine (JVM) is an abstract computer architecture that can be implemented in hardware or software. Either implementation is intended to be included in the following description of a VM. For the purposes of this disclosure, the term “processor” may be used to refer to a physical computer or a virtual machine.
A Java™ virtual machine executes programs written in the Java™ programming language and is designed for use on desktop computers, which are relatively rich in memory. However, various devices have relatively limited architectures. Resource-constrained devices are generally considered to be those that are relatively restricted in memory and/or computing power or speed, as compared to typical desktop computers and the like. Other resource-constrained devices include, by way of example, smart cards, cellular telephones, boundary scan devices, field programmable devices, personal digital assistants (PDAs) and pagers and other miniature or small footprint devices.
Smart cards are typically made of plastic or metal and have an electronic chip that includes an embedded microprocessor or microcontroller to execute programs and memory to store programs and data. Such devices, which can be about the size of a credit card, typically have computer chips with 8-bit or 16-bit architectures. Additionally, these devices typically have limited memory capacity. For example, some smart cards have less than one kilobyte (1K) of random access memory (RAM) as well as limited read only memory (ROM), and/or non-volatile memory such as electrically erasable programmable read only memory (EEPROM).
It would be desirable to write programs that use the full implementation of the Java™ virtual machine for execution on resource-constrained devices such as smart cards. However, due to the limited architecture and memory of resource-constrained devices such as smart cards, the full Java™ virtual machine platform cannot be implemented on such devices. Accordingly, a separate Java Card™ (the smart card that supports the Java™ programming language) technology supports a subset of the Java™ programming language for resource-constrained devices.
The Java Card™ runtime environment (JCRE) consists of Java Card™ system components that run inside a smart card. The JCRE is responsible for card resource management, network communications, applet (user applications on the Java Card™ platform) execution and on-card system and applet security. It essentially serves as a smart card operating system.
As illustrated in FIG. 2, the JCRE 205 sits on top of the smart card hardware and native system 200. The JCRE 205 includes the Java Card™ virtual machine (the byte-code interpreter) 215, the Java Card™ application framework classes (APIs) 250, industry-specific extensions 255 and the JCRE system classes 225.
The bottom layer of the JCRE 205 contains the Java Card™ virtual machine (JCVM) 215 and native methods 220. The JCVM 215 executes bytecodes, controls memory allocation, manages objects and enforces runtime security. The Java Card™ interpreter provides runtime support of the Java™ language model. The native methods 220 provide support to the JCVM 215 and the next-layer system classes 225. They are responsible for handling functions such as low-level communication protocols, memory-management and cryptographic support.
The system classes 225 act as the JCRE executive. They are analogues to an operating system core. The system classes 225 are responsible for making transactions (235), managing communication between the host applications and Java Card™ applets (240) and controlling applet creation, selection and deselection (230).
The Java Card™ application framework defines the APIs. Applets 210 access the JCRE services through APIs. Applets 210 are written in the subset of the Java™ programming language and controlled and managed by the JCRE 205. Applets 210 are downloadable and can be added to a Java Card™ technology-enabled smart card after it has been manufactured.
What is needed is a method and apparatus for deployment of high integrity software that simplifies program verification. A further need exists for such a solution that simplifies program verification of software developed for resource constrained devices such as smart cards. Yet a further need exists for such a solution that simplifies program verification of software developed for a Java Card™ technology-enabled device.